{"id":"CVE-2025-30045","kind":"vulnerability","aliases":["CVE-2025-30045"],"related":[],"title":"CGM CLININET: Perl expression handling lets an authenticated user run root code","description":"CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content. Due to improper control of the code evaluated from these expressions, an authenticated, high-privileged attacker can cause arbitrary code to be executed with root privileges. \n\n\nThe vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.","summary":"CGM CLININET's ConvExpr function evaluates Perl expressions while building RTF document content. A logged-in, high-privileged user can run arbitrary code as root on the server. CERT Polska confirms all versions through 2026.MS3 are affected and later ones may be too. No fixed release is published.","severity":"high","cvss":8.6,"epss":0.00199,"exploited":false,"exploited_at":null,"products":[{"name":"CGM CLININET","fixed":[],"affected":"<= 2026.MS3","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cgm-clininet","healthcare-it","linux","other","perl","rce","windows"],"not_affected_if":["auth-required","unauthenticated-only-access"],"how_to_check":"Check the installed CLININET release. Anything 2026.MS3 or earlier is affected. The advisory gives no file or command for this, so ask CGM. Also review which accounts hold high privileges, since exploitation needs one.","fix":"No fixed version is published. Unknown: ask CGM for a release after 2026.MS3. Until then, limit high-privilege accounts and keep the server off untrusted networks (the CVSS vector is adjacent-network).","status":"open","published_at":"2026-10-23T09:17:04+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:39:14+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-23T22:39:14Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"CGM CLININET: Perl expression handling lets an authenticated user run root code","impact":"high","summary":"CGM CLININET's ConvExpr function evaluates Perl expressions inside RTF document content without proper control. An authenticated, high-privileged user can execute arbitrary code with root privileges.","category":"other","who_cares":["cgm-clininet","healthcare-it","windows","linux"],"confidence":0.6,"needs_auth":"yes","worst_case":"Code runs as root on the server; full system takeover possible.","analyst_note":"Find the vendor advisory or patched version for CGM CLININET (NVD entry lists no product versions beyond 'up to 2026.MS3'); confirm the platform and how to check exposure.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unauthenticated-only-access"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000469,"input_tokens":2954,"output_tokens":348,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory or patched version for CGM CLININET (NVD entry lists no product versions beyond 'up to 2026.MS3'); confirm the platform and how to check exposure.","search":"'-2025':14A,17A '-30045':15A,18A '2026':68B,138C 'affect':71B,134C 'also':144C 'arbitrari':55B,121C 'attack':118C 'authent':8A,114C 'build':41B 'caus':120C 'cert':62B 'cgm':1A,19A,22B,32B,83C 'cgm-clininet':21B 'clininet':2A,20A,23B,33B,84C 'code':12A,56B,88C,108C,122C 'confirm':64B,132C 'content':44B,101C 'control':105C 'convexpr':35B,92C 'cve':13A,16A 'document':43B,100C 'due':102C 'evalu':37B,109C 'execut':125C 'express':4A,39B,97C,112C 'fix':79B 'function':36B,93C 'handl':5A 'healthcar':25B 'healthcare-it':24B 'high':50B,116C 'high-privileg':49B,115C 'improp':104C 'inject':89C 'later':73B,141C 'let':6A 'linux':27B 'log':47B 'logged-in':46B 'may':75B,143C 'ms3':69B,139C 'one':74B 'perl':3A,29B,38B,96C 'polska':63B 'privileg':51B,117C,128C 'process':95C 'publish':82B 'rce':30B 'releas':80B 'root':11A,58B,127C 'rtf':42B,99C 'run':10A,54B 'server':61B 'user':9A,52B 'version':66B,135C,142C 'vulner':86C,130C,146C 'window':31B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T09:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-30045","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30045","severity":null,"published_at":"2026-10-23T09:17:04+00:00","modified_at":"2026-10-23T16:28:32+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2025-30045:481","url":null,"severity":null,"published_at":"2026-10-23T23:37:32+00:00","modified_at":"2026-10-23T23:37:32+00:00","first_seen_at":"2026-10-23T23:37:32+00:00","fetched_at":"2026-10-23T23:37:32+00:00","note":"CERT Polska advisory (CNA) read: affects all versions through 2026.MS3, no fixed version published; sibling CVEs fixed in MS3 but this one is not. No exploit or PoC per VulDB; no social discussion searched."},{"source":"epss","external_id":"CVE-2025-30045","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-30045","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1323,"url":"https://cert.pl/en/posts/2026/10/CVE-2025-30043/","title":"CERT Polska: Vulnerabilities in CGM CLININET software","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2076,"url":"https://vuldb.com/vuln/425619","title":"VulDB: CGM CLININET ConvExpr code injection","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}